On October 21, 2026, two serious security vulnerabilities were announced in PHP, a technology used by WordPress and many other websites.
These vulnerabilities could potentially allow attackers to run malicious code on affected servers. Security updates have been released, and hosting providers are taking steps to protect their customers while deploying the fixes.
We are sharing this update to help you understand the situation, what hosting providers are doing, and whether any action is needed.
What does this mean for your website?
PHP runs on your website's hosting server and is generally maintained by your hosting provider. This means security updates are typically handled at the hosting level rather than through changes you need to make within WordPress.
Whether a website is affected depends on its PHP version and hosting environment. Not every website is necessarily vulnerable.
Updates from hosting providers
Several of the primary hosting providers we work with have shared information about their response. Below is a summary of their reported actions as of October 21, 2026.
Pantheon
Pantheon reports that it is deploying the security fixes across its hosting environment, including protections for websites running older PHP versions. Additional security measures have been implemented while updates are completed.
Pantheon has indicated that no action is needed from customers.
Provider status: https://status.pantheon.io/incidents/x7h8z1yhgvml
WP Engine
WP Engine reports that it is deploying the security fixes across its hosting environment. Additional security protections have also been implemented to help identify and block potentially malicious requests.
Provider status: https://wpenginestatus.com/
Kinsta
Kinsta is implementing temporary security protections while testing the permanent fixes. Once testing is complete, the provider plans to deploy the updates.
Kinsta has indicated that customers do not need to take action and will receive an email notification when their websites have been updated.
Provider status: https://status.kinsta.com/
HostGator
HostGator reports that temporary security protections are in place and that it is working to deploy the permanent fixes.
The provider does not anticipate disruptions to websites or email services. However, customers may temporarily experience reduced file upload size limits.
Provider announcement: https://www.hostgator.com/status/announcement/277
Do you need to take action?
For websites hosted with the providers listed above, the hosting companies are managing the server-level security response. Most clients should not need to make any immediate changes based on this announcement.
Some websites, particularly those running older PHP versions or using specialized hosting configurations, may require additional review or coordination.
There is no need to change your website's PHP version independently in response to this bulletin.
Questions or concerns?
If you have questions about your website, its hosting provider, or the potential impact of these vulnerabilities, please contact our support team.
For the latest information about deployment progress, we recommend referring to your hosting provider's official status page linked above.